diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cb3dfe7a..563b00d1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,4 +8,21 @@ updates: commit-message: prefix: "dependabot" labels: - - "dependencies" \ No newline at end of file + - "dependencies" + + # Keeps the SHA-pinned actions in publish-to-pypi.yml patched. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + commit-message: + prefix: "ci" + labels: + - "dependencies" + - "github-actions" + groups: + actions-minor-and-patch: + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 9e0f6f9f..840ed777 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -11,19 +11,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - run: pip install pytest - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build E2E image (cached) - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: tests/e2e/Dockerfile @@ -39,7 +39,7 @@ jobs: - name: Upload generated outputs on failure if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-outputs-linux path: /tmp/pytest-of-runner/**/container_work*/** @@ -48,9 +48,9 @@ jobs: runs-on: windows-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' @@ -81,8 +81,10 @@ jobs: - name: Send failure notification to Slack if: ${{ env.SLACK_WEBHOOK_URL != '' }} - uses: slackapi/slack-github-action@v1.24.0 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: + webhook: ${{ env.SLACK_WEBHOOK_URL }} + webhook-type: incoming-webhook payload: | { "text": ${{ toJSON(format('[Codeplain Client] E2E tests FAILED on {0}. See <{1}/{2}/actions/runs/{3}|the run log>.', steps.platforms.outputs.failed, github.server_url, github.repository, github.run_id)) }} diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml index c757e5e1..fd135f0b 100644 --- a/.github/workflows/lint-and-test.yml +++ b/.github/workflows/lint-and-test.yml @@ -12,13 +12,13 @@ jobs: name: Black Formatting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -33,13 +33,13 @@ jobs: name: Import Sorting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -54,13 +54,13 @@ jobs: name: Flake8 Linting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -75,13 +75,13 @@ jobs: name: MyPy Type Checking runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -96,9 +96,9 @@ jobs: name: Run Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Configure git for tests @@ -107,7 +107,7 @@ jobs: git config --global user.name "Test Runner" git config --global init.defaultBranch main - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -122,5 +122,7 @@ jobs: coverage run -m pytest tests/ -v coverage xml coverage report - - name: Upload coverage reports - uses: codecov/codecov-action@v3 + # Disabled: v3's Node runtime is gone from the runners. Re-enable with a + # current major version, which renamed several inputs. + # - name: Upload coverage reports + # uses: codecov/codecov-action@v3 diff --git a/.github/workflows/lint-powershell.yml b/.github/workflows/lint-powershell.yml index c12e1ada..b67ec7b8 100644 --- a/.github/workflows/lint-powershell.yml +++ b/.github/workflows/lint-powershell.yml @@ -16,7 +16,7 @@ jobs: name: Parse under Windows PowerShell 5.1 runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # The install scripts are fetched over HTTP and executed on stock Windows, # where powershell.exe (5.1) is the default shell. 5.1 reads BOM-less files @@ -96,7 +96,7 @@ jobs: name: Parse under PowerShell 7 runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Parse each script with 7 shell: pwsh diff --git a/.github/workflows/nofity-slack-on-main-merge.yml b/.github/workflows/nofity-slack-on-main-merge.yml index a9a91c56..1d5e8a05 100644 --- a/.github/workflows/nofity-slack-on-main-merge.yml +++ b/.github/workflows/nofity-slack-on-main-merge.yml @@ -12,11 +12,11 @@ jobs: if: github.event.pull_request.merged == true steps: - name: Send notification to Slack - uses: slackapi/slack-github-action@v1.24.0 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: + webhook: ${{ secrets.SLACK_WEBHOOK_URL }} + webhook-type: incoming-webhook payload: | { "text": ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, github.event.pull_request.title, github.actor)) }} } - env: - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} diff --git a/.github/workflows/publish-install-script.yml b/.github/workflows/publish-install-script.yml index 94f2b1b0..bc0cf251 100644 --- a/.github/workflows/publish-install-script.yml +++ b/.github/workflows/publish-install-script.yml @@ -18,7 +18,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Upload install scripts to R2 env: diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml index 01d06903..ccff0eec 100644 --- a/.github/workflows/publish-to-pypi.yml +++ b/.github/workflows/publish-to-pypi.yml @@ -19,7 +19,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # hatch-vcs derives the version from git tags, so we need full history. fetch-depth: 0 @@ -46,7 +46,7 @@ jobs: ls -l dist/ - name: Store the distribution packages - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: python-package-distributions path: dist/ @@ -81,13 +81,13 @@ jobs: steps: - name: Download distribution packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: python-package-distributions path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 - name: Notify Slack (success) if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }} @@ -102,3 +102,45 @@ jobs: curl -s -X POST "$SLACK_WEBHOOK_URL" \ -H 'Content-type: application/json' \ --data "{\"text\":\"*Codeplain Client*: Publishing \`${{ github.ref_name }}\` to PyPI FAILED :x:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}" + + # Release pipelines to be turned on only after the rest of the infrastructure + # is ready. + # + # # Runs only after the package is on PyPI. Kept as its own job so the publish job + # # keeps its minimal permissions and no checkout. + # linear-release: + # name: Record release in Linear + # needs: publish-to-pypi + # runs-on: ubuntu-latest + # + # permissions: + # contents: read + # + # env: + # SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} + # + # steps: + # - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # with: + # # The scan needs full history. + # fetch-depth: 0 + # + # # Non-fatal: the package is already published. + # - name: Record release in Linear + # id: linear + # continue-on-error: true + # uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0 + # with: + # access_key: ${{ secrets.LINEAR_ACCESS_KEY }} + # version: ${{ github.ref_name }} + # # Pin the CLI the action downloads, not just the action. + # cli_version: v0.16.0 + # + # # continue-on-error keeps the job green, so this checks the step's own + # # outcome — `failure()` would never fire. + # - name: Notify Slack (release not recorded) + # if: ${{ steps.linear.outcome == 'failure' && env.SLACK_WEBHOOK_URL != '' }} + # run: | + # curl -s -X POST "$SLACK_WEBHOOK_URL" \ + # -H 'Content-type: application/json' \ + # --data "{\"text\":\"*Codeplain Client*: \`${{ github.ref_name }}\` is on PyPI, but recording it in Linear FAILED :warning:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"